Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42349 Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/… https://www.cve.org/CVERecord?id=CVE-2026-42349
Post summary
The message merely references CVE-2026-42349 and some Clerk JavaScript functions, without providing exploit code, patch info, or active exploitation evidence.
17 of 17 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | clerk | clerk\/astro | - | node.js | - |
| App | clerk | clerk\/backend | - | node.js | - |
| App | clerk | clerk\/chrome-extension | - | node.js | - |
| App | clerk | clerk\/clerk-expo | - | node.js | - |
| App | clerk | clerk\/clerk-js | - | node.js | - |
| App | clerk | clerk\/clerk-react | - | node.js | - |
| App | clerk | clerk\/expo | - | node.js | - |
| App | clerk | clerk\/express | - | node.js | - |
| App | clerk | clerk\/fastify | - | node.js | - |
| App | clerk | clerk\/hono | - | node.js | - |
| App | clerk | clerk\/nextjs | - | node.js | - |
| App | clerk | clerk\/nuxt | - | node.js | - |
| App | clerk | clerk\/react | - | node.js | - |
| App | clerk | clerk\/react-router | - | node.js | - |
| App | clerk | clerk\/shared | - | node.js | - |
| App | clerk | clerk\/tanstack-react-start | - | node.js | - |
| App | clerk | clerk\/vue | - | node.js | - |